Module protocol 

Stateless MCP over HTTP, protocol revision 2026-07-28 only. One POST carries one JSON-RPC request; everything the server needs is in that request.

Modules

context 🔒

Per-request client context from _meta. Every feature reads it here and has a fallback, so correctness never depends on what a client declares.

dispatch

JSON-RPC dispatch for one HTTP request: version negotiation, header checks, server/discover, tools/list and tools/call, including confirmation round trips through requestState.

error_codes 🔒

Our errors, in the implementation-defined range. MCP’s reserved codes are used from [ErrorCode] where they apply.

headers

Standard request headers (MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Param-*), which let rate limiting and logging route without parsing the body. They must agree with it.

progress 🔒

Progress notifications on the call’s response stream. A no-op unless the client sent a progress token and the transport streams the response.

Constants

PROTOCOL_VERSION 🔒

The only protocol revision the server speaks.

SETUP_DOCS_URL 🔒

Where teachers learn to set up their agent, including Codex’s 2026-07-28 opt-in.

Functions

www_authenticate_challenge 🔒

The WWW-Authenticate value of a 401 or 403 from the MCP server: where the client finds the authorization server (RFC 9728) and which scopes to ask for. error is the RFC 6750 error code and description, absent when no token was sent.